The cybersecurity industry is confronting a fundamental shift after the release of Anthropic's advanced vulnerability discovery model, Mythos.
As a result, the rise of AI-powered vulnerability discovery systems is prompting security leaders to question whether CVSS scoring remains fit for purpose.
As organizations face an unprecedented volume of newly discovered vulnerabilities, many argue that traditional severity-based prioritization models can no longer accurately reflect real-world risk, exploitability, or customer impact.
Speaking with CX Today, Shimon Tolts, CEO of Copperhelm, argued that this new reality is rendering traditional vulnerability prioritization models obsolete.
“Prioritization is dead,” he said.
"The National Vulnerability Database (NVD) essentially pausing its scoring earlier this year proves that static CVSS is becoming an obsolete metric.”
Why CVSS Scores No Longer Reflect Reality
CVSS, the Common Vulnerability Scoring System, is the industry-standard framework for assigning numerical severity ratings to vulnerabilities, used by organizations as the primary method to determine which should be remediated first.
And whilst a higher score indicated a greater risk, the growing volume of vulnerabilities discovered by advanced systems like Mythos has uncovered a major flaw with this approach.
When severity measures the potential impact of a vulnerability, it is incapable of determining whether it can really be exploited within a specific environment, as real-world risks are influenced by several immeasurable factors.
In this case, a vulnerability rated as critical on the CVSS may actually pose little practical danger if it is isolated from attackers.
On the other hand, a medium-severity vulnerability rating on an internet-facing system could represent an immediate threat.
“Severity labels are irrelevant,” Tolts noted.
“It doesn't matter what a scanner rates a flaw; what matters is whether it's actually exploitable in your specific environment.”
As organizations face an increasing number of findings generated by AI-assisted security tools, security teams are recognizing that numerical scores alone cannot accurately represent risk.
As a result, effective prioritization now requires additional understanding of how vulnerabilities interact with the organization's specific environment, rather than relying solely on generalized severity ratings.
Why Scores Miss the Threat
The emergence of AI-driven vulnerability discovery systems such as Mythos has reinforced the reality that attackers rarely rely on a single vulnerability to achieve objectives.
Instead, they frequently engage in attack chaining, linking individual minor vulnerabilities together to create a more serious compromise.
